// TECHNOLOGIES / AUTH0

Auth0

Auth0, as an attacker sees your app.

Auth0 runs your identity provider; what it cannot run is your application. The Dashboard shows the tenant settings you saved — it cannot show you that a client_secret reached the browser bundle, that a config file in your web root still lists http://localhost:3000 as an allowed callback, or that your own /callback route hands the authorization code to whatever returnTo says. NewScan proves those from outside, and treats your client_id and tenant domain as the public metadata they are.

▸ Run the free scan ← All technologies

The dashboard blind-spot

// why an external scan matters

// THE DASHBOARD SHOWS (WHAT YOU CONFIGURED)

Allowed callback URLs, connections, rules and actions, attack protection, MFA policy — all as you configured them in the tenant.

// IT CAN'T SEE (NEWSCAN DOES)

That confidential-client credentials were shipped to every visitor, that a deployed config still admits localhost, and that once the code has landed on your registered callback, where your code forwards it is entirely your responsibility — and Auth0's allow-list cannot help past that point.

What NewScan records

// proven, then reproduced

Client secret in client-side code

CRITICAL

A client_secret or private key readable in the browser bundle beside confirmed tenant configuration. Auth0 does not issue a secret to a public client, which is precisely why its presence is the finding.

Auth0 configuration exposed

HIGH / MEDIUM

A config served anonymously carrying credential material, or a callback/origin allow-list admitting a wildcard or localhost in production. An exact production allow-list is correct and stays silent.

Code issued to an unregistered redirect URI

HIGH

The verified tenant authorization endpoint redirects a code or token to a canary host — the lever behind the Kia dealer-portal and 16-automaker OAuth takeovers.

Callback forwards the code off-origin

HIGH

Your own callback takes an attacker-supplied destination and redirects to it carrying the authorization code. An open redirect that forwards no credential is a different, generic class.

What is never flagged

// the false-positive contract

A scanner earns its place by what it stays quiet about. These are guarantees, each one asserted by a test that fails the build if it regresses — not best-effort tuning.

client_id, tenant domain, JWKS, RS256 public keys

Public metadata that every correct Auth0 integration publishes. Fingerprint evidence only — never a finding, however many appear together.

A generic /authorize endpoint

Never treated as Auth0. A custom domain is accepted only when its own discovery document identifies Auth0.

Publishing a JWKS endpoint

Correct behaviour, not a vulnerability. The JWT tests stay generic.

Any login, user enumeration, password reset or code redemption

Out of scope. The callback test sends inert synthetic parameters and creates no session.

How it's proved

// training/tech/auth0

An Auth0-integrated app plus a local OIDC fixture, and a control publishing the identical client_id, tenant domain, RS256/JWKS document and Universal Login artifacts. The control must score zero.

// FINGERPRINT FIRST

The check is silent unless the product is confirmed by two independent signals. A single, spoofable marker confirms nothing.

// REPRODUCE BEFORE RECORD

Every finding is re-run by our own detector before it is written down. A model's self-assessment is discarded, not merged.

// SEVERITY THAT MAPS

One calibrated severity per finding, translated into PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA and NIST 800-53 ratings with remediation SLAs.

Run it against your own Auth0

NewScan is free and self-hosted — bring your own key. Every check on this page runs in the deterministic floor with no model and no provider key at all, so scanning your own Auth0 surface is local to you and depends on no hosted resource.

Get NewScan (FREE) → Talk through your results